CVE-2023-44443

NameCVE-2023-44443
DescriptionGIMP PSP File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PSP files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22096.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-5564-1
Debian Bugs1055984

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
gimp (PTS)bullseye2.10.22-4+deb11u2fixed
bullseye (security)2.10.22-4+deb11u1fixed
bookworm2.10.34-1+deb12u2fixed
bookworm (security)2.10.34-1+deb12u1fixed
sid, trixie2.10.38-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
gimpsourcebuster(not affected)
gimpsourcebullseye2.10.22-4+deb11u1DSA-5564-1
gimpsourcebookworm2.10.34-1+deb12u1DSA-5564-1
gimpsource(unstable)2.10.36-11055984

Notes

[buster] - gimp <not-affected> (Vulnerable code introduced in 2.10.22)
https://www.zerodayinitiative.com/advisories/ZDI-23-1593/
https://www.gimp.org/news/2023/11/07/gimp-2-10-36-released/#fixed-vulnerabilities
https://gitlab.gnome.org/GNOME/gimp/-/commit/96f536a33590bb9811da5b5639e1d6c25aaf2e01
Backport to gimp-2.10: https://gitlab.gnome.org/GNOME/gimp/-/commit/ef12c0a90752a06d4c465a768d052b07f5e8a8a0 (GIMP_2_10_36)
https://gitlab.gnome.org/GNOME/gimp/-/issues/10072 (restricted)
Introduced by: https://gitlab.gnome.org/GNOME/gimp/-/commit/bf66a07d207bc09f222e56c398760478a3a057fa (GIMP_2_10_22)

Search for package or bug name: Reporting problems